{"id":"CVE-2026-65604","revision":"887abfbb73934b769c73b71d3f97ee27","records":[{"revision":"887abfbb73934b769c73b71d3f97ee27","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-65604","aliases":[],"title":"Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass","description":"Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forbidden actions proceed. No fixed version is available; v0.27.26 adds documentation guidance only.","state":0,"publishedAt":"2026-07-23T21:16:47.608+00:00","modifiedAt":"2026-10-08T15:23:56.122+00:00","affected":[{"ecosystem":"Vendor product","name":"skipper","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"zalando\",\n                    \"product\": \"skipper\",\n                    \"defaultStatus\": \"affected\",\n                    \"packageURL\": \"pkg:golang/github.com/zalando/skipper\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":8.8,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734","https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65604","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-65604","identifiers":["CVE-2026-65604"]},"retained":false,"historicalAffected":[]}],"coverage":[]}